Increase Fusion UI session timeout – Lucidworks

Goal

Configure the duration of time a user can remain authenticated in the Fusion UI before being automatically logged out due to inactivity.

Environment

Managed Fusion 5.x and above
Kubernetes-based deployments

Guide

The Fusion UI session duration is controlled by the JSON Web Token (JWT) expiration setting within the API Gateway service. By default, this is set to 1800 seconds (30 minutes).

Security considerations

Before increasing the session timeout, consider the following security implications:

Longer sessions increase the risk of unauthorized access if a workstation is left unattended.
Access revocations or password changes may not take effect until the current token expires.
A timeout of 1 to 2 hours is generally recommended as a balance between usability and security.

Configuration steps

To update the session timeout, the api-gateway configuration must be modified in the environment's configuration files (typically via a Git-based configuration repository or Kubernetes ConfigMap).

Locate the api-gateway configuration section.
Under the jwt and token blocks, update the expirationSecs value to the desired number of seconds. For example, to set the timeout to 2 hours, use 7200.

jwt:
  token:
    expirationSecs: 7200

Commit the changes to your configuration repository or apply the updated ConfigMap to the Kubernetes cluster.

Apply the changes

For the new timeout settings to take effect, the API Gateway deployment must be restarted. This triggers the service to reload the updated configuration.

Run the following command using kubectl:

kubectl rollout restart deployment api-gateway

Verification

You can verify the change by inspecting the browser cookies while logged into the Fusion UI:

Open the browser's Developer Tools (F12).
Navigate to the Application or Storage tab and select Cookies.
Locate the Fusion authentication cookie and check the Max-Age or Expires column to confirm it matches the new duration.

Note: Existing active sessions will not be updated automatically. Users must log out and log back in to receive a token with the new expiration duration.